ISO/IEC 42001 is the international management-system standard for artificial intelligence. It specifies how an organisation should plan, operate, monitor and improve its use of AI, in the same structural way ISO 27001 handles information security. It is a management system rather than a technical test: it certifies how you govern AI, not whether a particular model is safe.
Why it matters for a UK business
It is the standard clients, insurers and procurement teams are starting to ask about, and it is the one an AI governance programme can be built to without going through certification. Building to it costs weeks. Certifying against it is a separate decision with a separate cost.
What it looks like in practice
It is a management-system standard, the same family as ISO 27001 for information security. It asks how you run AI responsibly: risk assessment, roles, controls, documentation, review. It does not tell you which model to use.
What to do about it
Decide early whether you need to be aligned or certified. Most businesses of this size need aligned: the controls in place and evidenced, without the audit. Certification is awarded by an accredited body, not by a consultancy, and only makes commercial sense if a customer requires it.
Related terms
Read next
ISO 42001 vs the EU AI Act: which standard for UK SMEs → · All 22 terms in the glossary · The resource library
If this is the term that has come up in your business and you want it worked through against your own situation rather than in the abstract, that is a conversation, not a page.
Speak to ChrisWritten by Chris Duffy. Last reviewed .
